I have a Solaris 10 SPARC server that is running Splunk 4.1. It's configured to generate audit logs to syslog, create local log files, and Splunk is configured to forward them to a central Splunk server. The problem that I'm having is that Splunk is generating thousands of audit records per minute. They are all fcntl system calls. Here's an example record from praudit:
I suppose one question is what your BSM system is set up to audit. It's entirely normal for Splunk to be reading and writing many files a lot (that is it's purpose) and thousands of reads and writes per minute doesn't seem unreasonable, but it depends on whether these are files it is supposed to be reading and writing.